Service Dependency

Network Traffic Collection

This page shows all the traffic captured by sFlow, NetFlow and Promiscuous method by your configured Edge Device. You can create or update Business Services by using the filtering option. The three options provided are: filter by Network Traffic, Addresses and URL.

Note: 

• FireScope system is capable of collecting NetFlow as well as SFlow traffic. The user can choose the collector of their choice and configure it to point to the desired Edge Device.
• For SFlow traffic collection, we recommend using Host SFlow collector from http://sflow.net/.
• Network URL’s are only available when Promiscuous Mode has been enabled.

To create or update Service Group by Network Traffic

1. Click on Configuration > Service Dependency > Network Traffic. Network Traffic page will be displayed.
   Note: You can view the Network Traffic either in List view or Map view. List view is the default View.
   
   List View
   
   Map View
2. Select the preferred view by clicking on the drop down list in the upper right hand corner of the screen.
3. Select the Business Service Rule method to be used to discover services and dependencies.
4. Enter Source IP(s) or a CIDR netblock
5. Enter Target IP(s) or a CIDR netblock
6. Enter the Port used by your application.
   Note: You can enter a series of ports separated by commas or a range.
7. Select either Create New Service Group or Update Existing Service Group.
8. Select a Service Group from the drop down list to up date existing Service Group or Enter a name to create a new Service Group. Example below

Network Traffic Matching Filter List View

Network Traffic Matching Filter Map View

Create or update Service Group by Network Traffic Address List View

1. Select the the option Define by Address from the Set Business Service Rules drop down box.
2. You can filter by entering Source IP and/or Source Port. Click on filter button.
   Note: You can enter Source IP or DNS.
   
   Network Traffic – Filter by Address – List View
   
   
   Network Traffic – Filter by Address – Map View

Network URL

Network URL page shows all the Network URL collected on your configured Edge devices with details such as IPs of websites, number of  Clients connected to each website and their Port. You can create Business services based on URL filter. This is one of the ways to start mapping services.

Note: Network URL’s are only available when Promiscuous Mode has been enabled.To create Business Services

1. Click on Configuration > Service Dependency  > Network URL. Network URL page will be displayed.
2. Click on the Add sign next to the URL to add URLs to the Select URLs and port from below box.
   Note: You can select multiple URL’s.
3. You can edit the URLs by clicking on the Edit as Tags button.
4. Next, select one option from the drop down list Create New Service Group or Update Existing Service Group .
5. You can filter Network traffic by URLs by clicking on the link, network traffic page will be displayed.
6. To add more URLs click on ADD URL button.
7. Click on the Filter button to filter the newly added URLs. See Network Traffic for more information.

Create New Service Group

1. Enter a Name for Service Group.
2. Next click on the Create button. New Service Group is created.

Update Existing Service Group

1. Select an existing Service Group from the drop down list and click on the Update button.

Network Destination

Here you can view Network Traffic data collected on your configured edge devices grouped by Network Destinations.

1. Click on Configuration > Service Dependency > Network Destination. Network Destination page will be displayed.
2. Set Business Service Rule: Set Business Service Rule method to be used to discover services and dependencies for the selected Service Group.
3. Starting IP/DNS: Enter the source IP to filter Network Traffic by, enter a IP or DNS.
4. Port: Enter the Source Port to filter Network Traffic by. Enter a port number  
5. Select option: Select one option from the drop down list.
   • Create New Service Group: Enter new Service Group name and click on the Create button.
   • Update Existing Service Group:  Select a Service Group from the drop down list.

Amazon VPC Flow Logs

Setting up AWS Flow Logs for Dependency Mapping

The following guide is designed to aid in setting up VPC Flow logs from your AWS environment to your FireScope Edge VM.  These flow logs are blended with local netflow/sflow records to identify persistent connectivity between compute resources that indicate service dependencies.

High Level Overview of Setup of AWS Flow Logs for each VPC:

1. Create a Lambda function
2. Setup VPC flow logs on AWS
3. Verify flows are coming in

Functional Flow:

1. Every 15 minutes to 30 minutes they send flow data to a target
2. Logs are sent to S3 and the lambda has a trigger for it.
3. Lambda feature executes code to send those flow logs to Edge device, port 2200

 Create VPC Flow Log on AWS    

1. Click on the Console Home link in the upper left hand corner.
2. On the Console Home page, click on the VPC link under the Networking & Content Delivery section
3. Under You are using the following Amazon VPC resources in the XXX region:, click on 1 VPC
4. Select a VPC. Click on the Flow Logs tab
5. Click on Create Flow Log and select the following options:
   
   Filter: Accept
   Role: SPMFlowlogsRole
   Destination Log Group: flowLogsGroup
   
   Note: You can get more information on flow logs basics on AWS